The OpenJS Foundation CNA is taking a coordinated break from September 17 to October 6, 2026, and setting a good example for the community while doing it. The Express security team is joining the pause for the same window. Their post explains the reasoning, and it matches what we see in the Express ecosystem firsthand.
What this means for Express
From September 17 to October 6, 2026:
- Triage, patch development, advisory validation, CVE assignment, and security releases are paused.
- Channels stay open, so you can still file reports, but please do not expect a response until we return on October 7.
- Where possible, please hold non urgent reports until after the break, and keep following coordinated disclosure.
Emergency exception: if a vulnerability is being actively exploited, or poses immediate and serious risk, we will still respond. Reach out in the #express channel on the OpenJS Foundation Slack, keep the first message high level, and mark it urgent.
We will be back on October 7, 2026. Thank you for following coordinated disclosure.
To the maintainers who build on Express, and to the wider community: we hope you find your own moments to rest and recharge too.
The Express Security Team
